Evidence is everywhere in any investigation but much of it is hidden from view. The key first step to finding critical evidence is to be aware of the possibilities of today's forensic technology.

This is the first of a two-part series on forensic document evidence, developed in close cooperation with the Miami-Dade (Florida) Police Department Crime Laboratory. (Any opinions or recommendations are the authors' and do not necessarily represent the policies of the Miami-Dade Police Department.)  

The first installment covers traditional document examination, how to select a qualified document examiner, and evidence handling procedures.   

The second part, which will appear in the March/April issue, will discuss "Star Wars" technology in documentary evidence, including identifying altered writing, recovering erased or obliterated writing, obtaining evidence from indented writing, fingerprint evidence, and DNA analysis. - ed.

A Different Mind-set

Documentary evidence is a critical component of virtually every fraud investigation. Fraud examiners are conditioned by our education and experience to look at the numbers, words, and notations on a document to try to fathom their meaning. We also try to figure out how they relate, if at all, to the case we are investigating. What we are looking for is the intellectual content of the document. We are also looking for patent evidence - evidence we can see with the naked eye.

In this article, we are going to examine not just the content within a document but also the physical evidence found on the document. We will also be talking about several types of latent evidence - evidence we cannot see without some sort of technology.

The most basic principle of a crime scene investigation is that a perpetrator always takes something from the scene and always leaves something behind. In a shooting, for instance, a bullet may yield ballistic evidence. Other evidence may pinpoint the locations of the parties when the shots were fired including the distance from the gun to the target. Extractor marks on cartridges found at the scene may match a gun later recovered. Fingerprints may be developed and DNA may be found and analyzed.

The shooter may also take away gunshot residue on his hands, microscopic fibers from the room on his clothes, an injury suffered in the struggle, etc.

Other crimes are no different. Crime does not have to be violent to generate significant physical evidence. We will examine several types of physical evidence that may be available on any document. We will begin with traditional document examination and proceed to DNA analysis.

What is a 'Document?'

We are all familiar with various accounting documents, financial instruments, and the like. Any kind of letter or note is obviously a document. But what about "Redrum," scrawled on a mirror with lipstick? Or barely visible marks written on the palm of a hand? Or a cattle brand? Are these documents? Yes. A document is any fixed means of communication. Therefore, the Ten Commandments chiseled on stone tablets would be a document but Native American smoke signals would not.

Questioned Document Examination

Traditional forensic document analysis is more appropriately called "questioned document examination." A questioned document examination evaluates authorship and authenticity. Document examination does not reveal age, sex, physical characteristics, personality traits, or other personal information about the writer. For those characteristics, consult a psychic hotline.

Real questioned document examination includes determining whether a suspect executed a disputed signature or wrote a particular document. The examiner uses objective handwriting characteristic criteria to evaluate written materials including all of the physical movements of writing. This includes visual evaluation and meticulous hand-glass and microscopic examination. The examiner uses subjective methods derived from training and experience to form an expert opinion.

The examiner first analyzes the document by itself and then compares it to other writings of known authorship and authenticity, which are called standards.

The examiner must do "apples to apples" comparisons - cursive writing to cursive writing, printing to printing, numbers to numbers, etc. When the same words and phrases are not available in the standards, the examiner will require a much greater volume of them and more analysis to develop an accurate opinion.

In making comparisons, document examiners use non-requested and requested standards. Non-requested standards are items written during the normal course of events, rather than from an investigator's request. These standards are valuable because the subject writes them in an unstressed environment and does not know that they will be used later. Therefore, non-requested standards are usually most typical of the subject's normal handwriting. The downside of non-requested standards is that they may not contain the exact words and letter combinations the examiner is seeking so the examination will need a greater volume of standards.

The examiner dictates the requested standards by asking the subject to write the exact words requested. This gives an exact "apples to apples" comparison but, obviously, the subject may attempt to disguise his writing to foil the investigation. In fact, qualified examiners estimate that 80 percent of their subjects attempt to disguise requested standards. However, if that attempted disguise is detected it may be damning evidence of criminal intent.

Normally, document examiners will request at least 25 requested standards or all available non-requested standard material.

Document Examination Opinions

The examiner compares the objective handwriting characteristics in the questioned document to those in the known standard and forms an opinion. The opinion may range from positively identified, to highly probable, to probable, and through the continuum to positively eliminated.

In evaluating expert testimony, it is important to understand that a conservative document examiner will always give an opinion that is less definitive than what he or she knows to be true. There is a difference between what they know and what they can testify to in court.

If a well-trained, qualified, conservative document examiner offers an opinion that a subject "probably wrote" a document, then the subject wrote the document. However, there may be something about either the evidence or the available standards that does not permit the examiner to say that with absolute certainty. "Positive ID" does mean 100 percent but for most conservative examiners, "probable" means something like 95 percent+ and "highly probable" means 99.5 percent+.

But if you receive opposite opinions from two different document examiners, something is profoundly wrong. Opposite opinions just do not happen between honest, well-trained examiners.

One document examiner may call a case "highly probable," while another rates it "probable." You might get a weak "probable" from one examiner and a "no opinion" from another. Those slightly different opinions mean one examiner is a little more conservative than the other. But if you see "probably did" and "probably did not" on the same case, one examiner is either (a) incompetent, or (b) "biased" - to be extraordinarily kind. Some examiners will do everything they can to make their opinion coincide with the interests of their clients. Ethical examiners are conservative and "call 'em as they see 'em."

How Do I Select a Qualified Document Examiner?

It is important to understand that there are document examiners ... and, well, there are document examiners.
A well-qualified document examiner should offer all or most of the following qualifications:

• a degree in one of the hard sciences (chemistry, physics, biology, etc) or criminal justice (criminology, forensic
  science, etc.) not psychology, sociology, anthropology, English literature, etc.;
• intensive, long-term, structured training by law enforcement agency - two years is the standard training period;
• extensive experience in forensic document examination, including expert witness certification; and
• strong references from past clients who have successfully used their services.

There are approximately 8,000 "handwriting analysts" in the U.S., but only about 1,000 of them match the above criteria. The rest are probably "graphologists" who claim to be able to determine personality, physical characteristics, and many other things from a review of a person's handwriting. Whether they can or cannot is both controversial and irrelevant. What is relevant in a legal proceeding is whether they can determine authorship and authenticity. Courts, however, routinely accept graphologists as expert witnesses.

Hire the most qualified, conservative document examiner you can. Be prepared to lose your court case if you hire a marginally qualified examiner and the other side hires an experienced, law enforcement-trained, questioned document examiner.

What about "certifications?" Some certifying organizations require excruciating proof of competence. But others only require the check to clear the bank. Just as in our profession, organizations run the gamut from highly ethical to outright frauds.

Document examiner certification alone is no guarantee of proficiency. Extraordinarily well-qualified document examiners have spent their entire careers in law enforcement but are not certified by anybody. Former FBI examiners, in particular, feel that if their work was good enough for the Bureau, it should be good enough for anybody - a perfectly sensible viewpoint. Others have an endless string of letters after their name but are totally incompetent.

Rather than playing the certification game, follow these recommendations:

1. Call local law enforcement agencies and ask for a referral in the crime laboratory first (if they have one), the fraud unit (if they have one), and the detective bureau (if they do not have a fraud unit).

Some local law enforcement agencies have well-qualified examiners and allow them do outside civil work. If they do not have examiners, they use someone from a state laboratory, or a private examiner. Department policies may prohibit the agencies from giving you a direct referral, but they can point you in the right direction.

2. If local law enforcement cannot help, try state and federal law enforcement agencies. In the U.S. federal system, the FBI, Secret Service, and Postal Inspection Service extensively use document examiners. One of these agencies may be able to refer you to a retired agent who is a well-qualified document examiner.

3. Check with local attorneys to find well-regarded document examiners in your community. Attorneys use document examination in a wide range of legal actions.

Candidate Due Diligence

Conduct thorough due diligence on your candidates because your case may rest on this selection.

1. The candidates' entry-level training will tell you more about their abilities than any other single factor. Each should have had a minimum of a 1 1/2- to two-year internship in a law enforcement agency. Be wary if the candidates talk about certification and experience rather than initial training. If the candidates trained under someone in private practice, ask how long the training was and about the trainer. Look elsewhere if the candidates' training is not adequate.

2. Ask if they are qualified as expert witnesses in local courts.

3. Ask if they can offer expert testimony on authorship and authenticity of handwriting. Do not be too impressed if they say yes - everybody says yes.

4. Ask if they can evaluate personality and other personal characteristics from handwriting. If they say yes, move on to other candidates.

5. Obtain attorney references. Ask the attorneys not only about the candidates' work quality but also about effectiveness as witnesses.

Read part two in the March/April issue. 

James D. Cooner, CFE, is president of Aspen Consulting Group in Miami, Fla. He is also an ACFE faculty member and chairman of the Association's Continuing Education Committee. His e-mail address is: aspen_consulting@bellsouth.net. Harry Coleman is a Questioned Document Examiner in the Miami-Dade (Fla.) Police Department Crime Laboratory. His e-mail address is: hcoleman@mdpd.com. 

The authors wish to thank these colleagues for their advice and assistance in preparing this article: Commander James Carr of the Miami-Dade (Fla.) Police Department Crime Laboratory Bureau; and Supervisor "Bud" Stuver, Michael Haas, Ph.D., Toby Wolson, and Stephanie Stoiloff of the crime laboratory's Serology/DNA Section.

Handle Documentary Evidence with Kid Gloves

Any evidence submitted in court is going to be challenged on three grounds: the legality of the seizure of the evidence, the integrity of the evidence (i.e., is it possible that the evidence has been changed in any way from the time the evidence was seized until it was introduced in court?), and the interpretation of the evidence. Follow consistent evidence impounding procedures to ensure critical protection of the evidence from impoundment through introduction in court.

To maintain the document in the same condition as it was discovered:

• do not fold, cut, staple, trim, or add notations to documents;
• place all identifying marks on the packaging, not on the documents and retain the packaging to preserve the chain of custody; and
• document the chain of custody of the evidence completely and continuously.

Paper-and-ink documents are fragile and susceptible to damage or deterioration. Therefore, it is critical to gingerly handle and package documentary evidence.

Package dry documents in either plastic or paper bags or envelopes. A dry document will not deteriorate significantly. However, wet documents present special challenges. Paper is nothing more than pulverized wood and glue so wet paper actually glues one page to another as it dries. Sepa-rating dried paper often destroys much of the evidence.

Never attempt to dry a wet multi-page or folded document. Seal wet paper in an airtight plastic container or envelope, and submit it to the document examiner as soon as possible. The examiner will have the equipment to dry the document one page at a time without destroying evidence.

Occasionally, in an accident situation for example, you may encounter documents, which are wet with blood or other body fluids - a scenario fraught with problems. There is an easy rule-of-thumb for evaluating evidence, which may be stained with any kind of body fluids: "If it's wet, it's yucky!" Don't take foolish risks; wear protective gloves and seal the wet document in an airtight plastic container or bag and immediately deliver to the document examiner. Blood is subject to microbial degradation, which will quickly destroy evidence, and it contains a considerable amount of starch, a natural glue.

Almost any kind of forensic examination may damage a document. Therefore, regardless of what type of evidence is sought, all documents should go to a document examiner first. A well-trained examiner will be able to inspect the document without destroying evidence.